Business Associate Agreement

1.1. This BAA applies only if, and only to the extent that, you are a covered entity under HIPAA, or act on behalf of one, and Florence creates, receives, maintains or transmits Protected Health Information ("PHI") on your behalf through the Covered Features. In that case Florence is your business associate. If HIPAA does not apply to you, this BAA has no effect.

1.2. You accept this BAA once, in the Florence app, by choosing "I accept". Florence records the version you accepted and the date in your account. No handwritten signature is needed.

1.3. "Covered Features" means Transcription, Differential Diagnosis (including the Patient Context and the note templates used with them) and Florence Agent.

1.4. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the HITECH Act and their regulations at 45 C.F.R. Parts 160 and 164. Terms that HIPAA defines have the same meaning here.

2.1. Florence may use and disclose PHI only to provide the Covered Features to you, as the Terms and the Privacy Policy describe, and as the law requires.

2.2. Florence may also use PHI as needed for the proper management and administration of the service, for example to keep it secure or to investigate a failure, and to meet its legal obligations.

2.3. Florence will not use PHI to train, fine-tune or improve artificial intelligence models, will not sell PHI, and will not use PHI for advertising or marketing. Florence's contract with its AI provider forbids that provider from using PHI to train or fine-tune artificial intelligence models.

2.4. Florence will not use or disclose PHI in a way that would violate the HIPAA Privacy Rule if you did it, and will limit its use of PHI to the minimum necessary.

Florence will:

(a) use or disclose PHI only as this BAA permits or as the law requires;

(b) use appropriate safeguards, and comply with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C) for electronic PHI, to prevent any use or disclosure that this BAA does not permit;

(c) report to you any use or disclosure of PHI that this BAA does not permit, and any security incident, that Florence becomes aware of. Florence will report a breach of unsecured PHI without unreasonable delay and no later than 30 calendar days after discovering it, with the information that 45 C.F.R. § 164.410 requires, to the extent Florence has it. Attempts that do not succeed, such as scans or failed sign-ins, are reported by this sentence and need no further notice;

(d) make sure that every subcontractor that creates, receives, maintains or transmits PHI for Florence agrees in writing to the same restrictions and conditions that apply to Florence;

(e) make PHI available to you so that you can answer a patient's request for access, for amendment or for an accounting of disclosures (45 C.F.R. §§ 164.524, 164.526 and 164.528). Florence does not keep a patient record: session data is deleted as Section 5 of the Privacy Policy describes, and the note you save in your own system is the record. Florence will keep a record of any disclosure that must appear in an accounting and give it to you on request;

(f) comply with the requirements of the HIPAA Privacy Rule that apply to you, to the extent Florence carries out one of your obligations under that Rule;

(g) make its internal practices, books and records about PHI available to the Secretary of the U.S. Department of Health and Human Services, to determine compliance with HIPAA.

You will:

(a) use the Covered Features only as HIPAA allows, and not ask Florence to use or disclose PHI in a way that would violate HIPAA if you did it;

(b) hold every consent, authorization and notice that the law requires for the PHI you enter, including the patient's consent to record the consultation where the law of your state requires it;

(c) tell Florence about any restriction or change in a patient's permission that affects how Florence may use PHI;

(d) keep the note in your own record system. Florence is not a record system.

As Section 4.1(vii) of the Terms says, you confirm that you have the authority to use the Platform for this PHI.

5.1. This BAA starts when you accept it. It ends when your account is closed or the Terms end.

5.2. You may end this BAA, by closing your account, if you determine that Florence has violated a material term of it. Florence may end it if you violate it.

5.3. When this BAA ends, Florence will return or destroy all PHI that it still holds and will keep no copies. Session data is deleted automatically (Section 5 of the Privacy Policy), so Florence normally holds no PHI at that point. If returning or destroying some PHI is not feasible, Florence will keep protecting it under this BAA and will use it only for the purposes that make its return or destruction infeasible.

5.4. Sections 3 and 5.3 continue to apply for as long as Florence holds any PHI.

6.1. If this BAA and the Terms disagree about PHI, this BAA prevails. If you, or the organization you work for, have a separate business associate agreement with Florence, that agreement prevails over this one. An agreement for a whole organization is negotiated separately: business@florence-app.com.

6.2. In every other respect the Terms apply to this BAA, including their limitation of liability and their governing law.

6.3. A reference to a section of HIPAA means that section as amended. Florence may change this BAA, for example to keep it in line with the law. Each new version has its own version number, and the app asks you to accept it before you continue to use the Covered Features. Any ambiguity is resolved in the way that lets both parties comply with HIPAA.

6.4. This BAA gives rights only to you and to Florence.

6.5. Florence sends notices to the email address of your account. Send yours to dpo@florence-app.com. You can read this BAA at any time in the app, in your Profile, and at florence-app.com/en/baa.